{"type":"doc","content":[{"type":"paragraph","content":[{"text":"Namespace: ","type":"text","marks":[{"type":"strong"}]},{"text":"urn:mace:shibboleth:2.0:resolver","type":"text","marks":[{"type":"code"}]},{"type":"hardBreak"},{"text":"Schema: ","type":"text","marks":[{"type":"strong"}]},{"text":"http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/schema/idp/shibboleth-attribute-resolver.xsd"}}]}]},{"type":"extension","attrs":{"layout":"default","extensionType":"com.atlassian.confluence.macro.core","extensionKey":"toc","parameters":{"macroParams":{"maxLevel":{"value":"3"}},"macroMetadata":{"macroId":{"value":"94571385-9a0e-40e7-9a3f-79a74b7f6504"},"schemaVersion":{"value":"1"},"title":"Table of Contents"}},"localId":"3c10a998-16f2-4035-8791-4678589f10f2"}},{"type":"heading","attrs":{"level":2},"content":[{"text":"Overview","type":"text"}]},{"type":"paragraph","content":[{"text":"The ","type":"text"},{"text":"ScriptedAttribute","type":"text","marks":[{"type":"code"}]},{"text":" AttributeDefinition constructs an output attribute via the execution of a ","type":"text"},{"text":"JSR-223","type":"text","marks":[{"type":"link","attrs":{"href":"https://docs.oracle.com/en/java/javase/11/scripting/index.html"}}]},{"text":" script. Scripts are somewhat easier to write and maintain than native Java code, though they are slower. They can also be changed dynamically since the resolver is a ","type":"text"},{"text":"ReloadableService","type":"text","marks":[{"type":"link","attrs":{"href":"/wiki/spaces/IDP4/pages/1265631674"}}]},{"text":".","type":"text"}]},{"type":"heading","attrs":{"level":2},"content":[{"text":"Scripting","type":"text"}]},{"type":"expand","attrs":{"title":"Script Context"},"content":[{"type":"paragraph","content":[{"text":"The script \"context\" defines the execution environment for the script and provides the following variables:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"resolutionContext","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"AttributeResolutionContext","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-identity-provider.cgi/net/shibboleth/idp/attribute/resolver/context/AttributeResolutionContext"}}]},{"text":" ","type":"text","marks":[{"type":"em"}]},{"text":"for the current resolution step, which exists within the tree of state information that tracks the current request","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"id","type":"text","marks":[{"type":"strong"},{"type":"em"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Variable which implements ","type":"text"},{"text":"ScriptedIdPAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net/shibboleth/idp/attribute/resolver/scripted/ScriptedIdPAttribute"}}]},{"text":", whose name is the ID of the AttributeDefinition, and which will be the output of the script. Note: If an attribute of this same name occurs as a dependency (see below), then the attribute will be pre-populated with all the values of the dependent attribute.","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"profileContext","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"ProfileRequestContext ","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-opensaml.cgi/org/opensaml/profile/context/ProfileRequestContext"}}]},{"text":"for the current resolution request, the \"root\" of the tree of state information","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"custom","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Contains whatever bean was referenced by the ","type":"text"},{"text":"customObjectRef","type":"text","marks":[{"type":"code"}]},{"text":" XML Attribute","type":"text"}]}]}]}]},{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"subjects","type":"text","marks":[{"type":"strong"}]}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Array of ","type":"text"},{"text":"Subject","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-jdk.cgi/javax.security.auth.Subject"}}]},{"text":" objects associated with this request. Note that these will only be present if the attribute resolution is associated with a completed authentication step (so is not present for back channel requests or certain other cases).","type":"text"}]}]}]}]}]},{"type":"paragraph","content":[{"text":"In addition, each defined dependency of the connector, it exists, will be present via an object which implements ","type":"text"},{"text":"ScriptedIdPAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi//net/shibboleth/idp/attribute/resolver/scripted/ScriptedIdPAttribute"}}]},{"text":".","type":"text"}]},{"type":"paragraph","content":[{"text":"For an AttributeDefinition dependency, that ","type":"text"},{"text":"IdPAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-identity-provider.cgi/net/shibboleth/idp/attribute/IdPAttribute"}}]},{"text":" is supplied. For a DataConnector dependency, each ","type":"text"},{"text":"IdPAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-identity-provider.cgi/net/shibboleth/idp/attribute/IdPAttribute"}}]},{"text":" produced by that connector is supplied.","type":"text"}]},{"type":"paragraph","content":[{"text":"The variable's name will be the attribute ID of the attribute from the dependency. In the event that more than one dependency produces attributes with the same ID, the values of all of those attributes are merged and made available to the script.","type":"text"}]},{"type":"paragraph","content":[{"text":"Note that any changes made to these dependency objects within the script will not be reflected in the result of the resolution process. In contrast, changes made to other objects accessed by means of the other variables in most cases will cause side effects, and should usually be avoided.","type":"text"}]}]},{"type":"expand","attrs":{"title":"ScriptedtIdPAttribute Class"},"content":[{"type":"heading","attrs":{"level":4},"content":[{"text":"Wrapper Class","type":"text"}]},{"type":"paragraph","content":[{"text":"The attribute variables (both input and output) available to the scripting environment are exposed using a wrapper class, ","type":"text"},{"text":"ScriptedIdPAttribute","type":"text","marks":[{"type":"link","attrs":{"href":"http://shibboleth.net/cgi-bin/java-idp.cgi/net/shibboleth/idp/attribute/resolver/scripted/ScriptedIdPAttribute"}}]},{"text":", which has the following methods:","type":"text"}]},{"type":"bulletList","content":[{"type":"listItem","content":[{"type":"paragraph","content":[{"text":"Collection